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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )E3 Responsive to communication(s) filed on 20 November 2006 . 
2a)(EI This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) S Claim(s) 1,3-6,9-11,13-16 and 19-21 is/are pending in the application. 

4a) Of the above ctaim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) [3 Claimfs) 1. 3-6, 9-11. 13-16 & 19-21 is/are rejected. 

7) D CJaim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)[>3 The drawing(s) filed on 25 September 2001 is/are: a)[3 accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)£3 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)IEI All b)Q Some * c)Q None of: 

1. KI Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 




3.D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



1. 



The response of 1 1/20/2006 was received and considered. 



2. 



Claims 1, 3-6, 9-1 1, 13-16 & 19-21 are pending. 



Response to Arguments 



3. Applicant's amendments filed 1 1/20/2006 overcome the rejections under 35 U.S.C. §112 
set forth in the previous Office Action. 

4. Applicant's arguments filed 1 1/20/2006 have been fully considered but they are not 
persuasive. 

5. Applicant's response (pp. 9-10) argues that Schnurer fails to disclose analyzing and 
cleaning, and Chess fails to disclose simulating in a virtual computer circumstance. However, 
Chess is relied upon for teaching analyzing and cleaning and Schnurer is relied upon for teaching 
simulating in a virtual computer circumstance. 

6. Applicant's response (p. 10) argues that "the step of obtaining pairs of objects (host and 
infected host) may in fact destroy or cause unpredicted damages to the computer running the 
program in Chess. However, Applicant has provided the exact motivation that is given in 
Schnurer for using a virtual environment. Therefore, Schnurer, as modified by Chess, eliminates 
this potentially dangerous circumstance as per the inventive concept in Schnurer. 

7. Applicant's response (pp. 10-11) argues that Chess fails to disclose the cleaning step of 
the present invention because Chess discloses extracting information to enable anti-virus 
software to complete the repair of an infected file by obtaining pars of the original, uninfected 
host files and the same programs after infection. However, an infected file cannot be repaired 
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unless the original file is restored from its infected portion and therefore the file must be cleaned. 
The repair information is only stored to repair a file more quickly in the future. 

8. Applicant's response (p. 11) argues that Chess teaches away from the present invention 
because the object is allowed to enter the real computer. However, Schnurer is not being 
modified to eliminate Schnurer' s virtual circumstance. Schnurer simply detects a virus, without 
repairing. One having ordinary skill in the art recognizes that this lack of cleaning or repairing is 
not a necessity of Schnurer' s invention, just that the invention was not described that far. 
Schnurer does, however, recognize the utility of running the viruses in a virtual computer 
circumstance. Chess, on the other hand, does disclose the analyzing of files and repair based on 
that analysis. Chess does not disclose that this is done in a virtual computer circumstance. 
However, this limitation of Chess does not imply that the benefit of working with viruses in a 
virtual computer circumstance as described in Schnurer cannot be combined with the analyzing 
and cleaning method of Chess to create a system which analyzes and repairs infected files in a 
virtual circumstance. On the contrary, both references describe that these benefits are an 
advantage and therefore, one having ordinary skill in the art would have been motivated to 
combine the references to gain the benefits of both in a single invention. 

9. Applicant's response (p. 11) argues that there would be no virus for which to scan using 
the system taught by Chess, in the system taught by Schnurer. However, as described above, one 
of ordinary skill would have been motivated to extend the utility of Schnurer' s virtual computer 
to repair a file after virus detection, as taught to be beneficial by Chess. Nothing in Chess 
requires that the method of Chess be performed in a computer (not in a virtual circumstance) and 
nothing in Schnurer requires that an infected file not be repaired using analysis. 
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10. Applicant's response (p. 11-12) argues that even if combined, Schnurer and Chess would 
not result in the present invention. However, as described above and below in the rejections 
themselves, Schnurer's virtual computer circumstance has the benefit and utility of detecting 
viruses where they cannot attack a computer and Chess's analysis and repair system has the 
benefit and utility of taking further steps to clean and infected file, based on analysis, and store 
the results of the analysis for the cleaning of the same virus from another infected file at a later 
date. 

Claim Rejections - 35 USC § 103 

1 1 . The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

12. Claims 1, 1 1 & 21 are rejected under 35 U.S.C. 103(a) as being unpatentable over U.S. 
Patent 5,842,002 to Schnurer et al. (Schnurer) and U.S. Patent 5,485,575 to Chess et al. (Chess). 

Regarding claims 1, 11 & 21, Schnurer discloses simulating in a computer a virtual 
computer circumstance (trapping device, col. 5, lines 7-10 & col. 6, lines 64-67), wherein 
computer viruses will reside on the virtual computer circumstance, providing a plurality of 
objects (files) to be infected by computer viruses that induce virus infection (col. 7, lines 39-43), 
loading a target object (data stream, col. 6, line 64 - col. 7, line 1 1 & col. 7, lines 25-52) to be 
scanned into said simulated virtual computer circumstance (trapping device), activating 
(executing) the target object (virus) to be scanned in said simulated virtual computer 
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circumstance (trapping device) to induce the virus infection of the plurality of objects (files, col. 
7, lines 39-43) to infect the plurality of objects to be infected (files) and generating standard 
samples (infected files) which have been infected (col. 7, lines 47-52), comparing the plurality of 
objects (files) after processing in the activating/executing step with the plurality of objects (files) 
to be infected originally provided, determining whether there is any change (CRC check) or not; 
if there is a change, the target object to be scanned contains virus, otherwise the target object to 
be scanned is free of viruses (col. 7, lines 39-52). Schnurer lacks analyzing to extract 
information on the viruses indicated by changes between the plurality of objects before infection 
and the standard samples after infection when it is determined that said target object to be 
scanned is a virus, said information including at least the size of the virus and key information of 
the host which has been changed by the virus and to clean the virus from the infected target 
object by locating the host body and the virus body in the target object, restoring modified key 
information of the host on the basis of said information and removing the virus body from the 
target object after the activation step according to the virus size. Chess teaches generated 
standard samples (infected-host, col. 5, lines 17-41), where if a virus is attached to the threat 
object and the virus is activated, the target object will include a host body and a virus body (Fig. 
3, infected host), extracting information (VAD) of virus infection based on a comparison of the 
infected files (col. 2, lines 66-67 & col. 4, lines 37-45) and the standard samples (infected-hosts, 
col. 6, lines 25-32), said information including at least the size (length) of the virus (col. 6, lines 
48-54) and key information (offset) which has been changed by the virus (col. 6, lines 45-54) and 
cleaning (repairing) the virus based on the information (VAD, col. 18, lines 30-38) for the 
purposes of detecting and removing viruses (col. 2, lines 55-59, col. 6, lines 17-20 & col. 22, 
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lines 36-43). While Chess does not explicitly teach locating the virus body, restoring unchanged 
key information and removing the virus body from the target object according to the virus size, 
this is inherently done if the original target (program) is to be restored to it's original, uninfected 
state (col. 22, lines 39-43 & Fig. 3). Therefore, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify Schnurer to extract 
information on the viruses indicated by changes between the plurality of objects before infection 
and the standard samples after infection when it is determined that said target object to be 
scanned is a virus, said information including at least the size of the virus and key information of 
the host which has been changed by the virus and to clean the virus from the infected target 
object by locating the host body and the virus body in the target object, restoring unchanged key 
information of the host on the basis of said information and removing the virus body from the 
target object after the activation step according to the virus size. One of ordinary skill in the art 
would have been motivated to perform such a modification to detect and remove the virus, as 
taught by Chess (col. 2, lines 55-67, col. 4, lines 37-45, col. 5, lines 17-41, col. 6, lines 17-20, 
col. 22, lines 36-43 & Fig. 3). 

13. Claims 3-4 & 13-14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Schnurer and Chess, as applied to claims 1 & 1 1 above, in further view of Connectix Virtual PC 
software by Connectix, Described in "Connectix Virtual PC" datasheet (VPC) and "Connectix 
Virtual PC Family Frequently Asked Questions" (FAQ). 

Regarding claims 3 & 13, Schnurer, as modified above, is silent regarding details of the 
emulation. However, Connectix teaches simulating a Central Processing Unit (CPU) (Pentium 
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chip, VPC, p. 1, 1J2), simulating an Operating System (OS) (PC-based operating system, VPC, p. 
1, HI & 1f3), and simulating peripheral storage devices by simulating storage space and structures 
of various peripheral storage devices (CD-ROM and PC disk or floppy disk, VPC, p. 2, f 3). 
Virtual PC is used to run applications for one platform (such as Windows) on another platform 
(such as Macintosh). Further, FAQ teaches that Virtual PC simulates both a hard disk and 
memory for the emulated software, in this case, Windows (FAQ, p. 9, f7). Therefore, it would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
simulate a CPU, OS, storage device and memory. One of ordinary skill in the art would have 
been motivated to perform such a modification to run Windows from within a Macintosh, as 
taught by Connectix (VPC, p. 1, f 1-3, p. 2, p & FAQ, p. 9, f7). 

Regarding claims 4 & 14, Schnurer discloses multiple baits of different sizes and contents 
(FAT, executables) (col. 8, lines 13-20). 

14. Claims 5-6 & 15-16 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Schnurer, Chess and Connectix, as applied to claims 4 & 14 above, in further view of U.S. 
Patent 6,067,410 to Nachenberg. 

Regarding claims 5 & 15, Schnurer discloses multiple baits of different sizes and contents 
(FAT, executables) (col. 8, lines 13-20), but lacks specifically a specific virus. However, 
Nachenberg teaches that the bulk of software viruses in DOS based systems are COM files. 
Therefore, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to include DOS COM bait files. One of ordinary skill in the art would have 
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been motivated to perform such a modification to include as bait commonly infected files, as 
taught by Nachenberg (col. 8, lines 13-20). 

Regarding claims 6 & 16, Schnurer discloses simulating the system time to generate 
virtual system date and time for inducing the viruses that are sensitive to date and time (col. 7, 
lines 33-35). 

15. Claims 9-10 & 19-20, as best understood, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Schnurer, Chess and Connectix, as applied to claims 3 & 13 above, in further 
view of U.S. Patent 5,537,636 to Uchida et al. (Uchida), U.S. Patent 6,356,915 to Chtchetkine et 
al. (Chtchetkine) & U.S. Patent 6,192,456 to Lin et al. (Lin). Schnurer as modified above, 
discloses system files and bait files for inducing viruses (Schnurer col. 6, line 64 - col. 7, line 1 1 
& col. 7, lines 25-52) and teaches that VPC is software emulation of the hardware on a PC 
(Connectix FAQ, p. 9, 1f6-7), but lacks explicit disclosure of sectors, tracks, cylinders, a primary 
boot sector and corresponding blank sector of the No. 0 track, next boot sector, File Allocation 
Table, root directory sector. However, Uchida teaches that disks contain cylinders, tracks and 
sectors (col 6, line 61 - col. 7, line 65), a primary boot sector (col. 8, lines 13-15) and 
corresponding blank sector of the number 0 track (col. 8, lines 28-32), and a File Allocation 
Table (col. 5, lines 46-50). Further, Chtchetkine teaches that the logical structure on the FAT file 
system requires a boot sector that describes the root directory sectors within the disk (col. 2, lines 
22-27). Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to assign memory to simulate a virtual hard disk including a space by 
sector number, track number and cylinder number, a primary boot sector and corresponding 
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blank sector of the No. 1 track, File Allocation table and root directory sector. One of ordinary 
skill in the art would have been motivated to perform such a modification to simulate in software 
the hardware (hard disk, floppy disk) of a PC, as taught by Connectix (Connectix FAQ, p. 9, 
7), Uchida (col. 5, lines 46-50, col. 6, line 61 - col. 7, line 65, col. 8, lines 13-15 & col. 8, lines 
28-32) and Chtchetkine (col. 2, lines 22-27). As modified, Schnurer lacks a next boot sector. 
However, Lin teaches that storing multiple partitions requires multiple boot sectors (Fig. 3 & col. 
4, lines 52-54). Therefore, it would have been obvious to one having ordinary skill in the art at 
the time the invention was made to include a next boot sector. One of ordinary skill in the art 
would have been motivated to perform such a modification to use multiple partitions, as taught 
by Lin (Fig. 3 & col. 4, lines 52-54). 



Conclusion 

16. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly,. THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
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however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael J. Simitoski whose telephone number is (571) 272-3841. 
The examiner can normally be reached on Monday - Thursday, 6:45 a.m. - 4:15 p.m.. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on (571) 272-3799. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



MJS 





January 11,2007 



